CVE-2022-24296
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Conditioning System GB-50AD Ver. 3.21 and prior, Air Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditioning System EB-50GU-A Ver. 7.10 and prior, Air Conditioning System EB-50GU-J Ver. 7.10 and prior, Air Conditioning System AE-200J Ver. 7.97 and prior, Air Conditioning System AE-200A Ver. 7.97 and prior, Air Conditioning System AE-200E Ver. 7.97 and prior, Air Conditioning System AE-50J Ver. 7.97 and prior, Air Conditioning System AE-50A Ver. 7.97 and prior, Air Conditioning System AE-50E Ver. 7.97 and prior, Air Conditioning System EW-50J Ver. 7.97 and prior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Conditioning System TE-200A Ver. 7.97 and prior, Air Conditioning System TE-50A Ver. 7.97 and prior and Air Conditioning System TW-50A Ver. 7.97 and prior allows a remote unauthenticated attacker to cause a disclosure of encrypted message of the air conditioning systems by sniffing encrypted communications.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-327
- Affected
- mitsubishi/ae-200a firmware · mitsubishi/ae-200e firmware · mitsubishi/ae-200j firmware · mitsubishi/ae-50a firmware · mitsubishi/ae-50e firmware · mitsubishi/ae-50j firmware · mitsubishi/ag-150a-a firmware · mitsubishi/ag-150a-j firmware · mitsubishi/eb-50gu-a firmware · mitsubishi/eb-50gu-j firmware · mitsubishi/ew-50a firmware · mitsubishi/ew-50e firmware · mitsubishi/ew-50j firmware · mitsubishi/g-150ad firmware · mitsubishi/gb-50a firmware · mitsubishi/gb-50ada-a firmware · mitsubishi/gb-50ada-j firmware · mitsubishi/te-200a firmware · mitsubishi/te-50a firmware · mitsubishi/tw-50a firmware
- Source
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
References
- https://jvn.jp/vu/JVNVU95298925/index.htmlThird Party Advisory
- https://www.mee.co.jp/psirt/vulnerability/pdf/2022-001.pdfThird Party Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-005_en.pdfVendor Advisory
- https://jvn.jp/vu/JVNVU95298925/index.htmlThird Party Advisory
- https://www.mee.co.jp/psirt/vulnerability/pdf/2022-001.pdfThird Party Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-005_en.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.